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VERIFICATION METHOD AND APPARATUS 

The present invention relates to methods and apparatus 
to enable secure, auditable, efficient and cost effective 
5 movement of items of value. 

The present invention will be described in the context 
of a retail application. It should be noted, however, that 
the invention could be applied in non-retail applications. 
Indeed the invention could be applied in any environment 

10 where items of value are transported and therefore exposed 
to risk of theft or tampering. Items of value in this 
context include bank notes, cheques, vouchers, stamps, 
fiscal stamps, coins, casino chips, lottery tickets, 
scratch cards and the like. The invention in itB widest 

15 sense could also be envisaged to relate to other valuable 
items that are transported under secure conditions such as 
gemstones, precious metals and the like. 

Items of value such as cash (coins and banknotes) are 
typically transported in a secure manner in tamper evident 

20 and secure containers. However it is known for individuals 
to open such containers without compromising the physical 
security measures. The recipient will then receive and 
accept the items not knowing that the container has been 
compromised • 

25 In accordance with a first aspect of the present 

invention, a method of verifying the integrity of an item 
of value received at a destination location following 
transfer from a source location comprises carrying out one 
or more verification steps, at least one of which comprises 

30 determining whether the time of arrival of the item of 
value at the destination location satisfies a predetermined 
condition. 

The invention introduces an event timing process as a 
means to provide a measure of the risk that an item of 
35 value is no longer genuine, for example a container or 
package has been tampered with. 
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There are a variety of ways in which the predetermined 
condition can be defined. For example, the verification 
process may be programmed to expect to receive the item of 
value at a certain absolute time or within a certain 
5 absolute time period. Thus for example it may be expecting 
a particular item of value between • 6pm and 7pm on a 
particular day. This time may be set independently or, 
more commonly, will be communicated to the destination 
location, for example on or in a container holding the item 
10 of value. 

Alternatively, the predetermined condition is 
determined in response to the time at which the item of 
value leaves the source location. Thus, once that time is 
known, the time of arrival of the destination location can 
15 be predicted and that part of the verification process will 
be satisfied if the item of value arrives within a 
predetermined tolerance of the expected time. 

Details of the predetermined condition could be stored 
in a memory, for example having been communicated from the 
20 source location, the memory being sited at the destination 
location or in a separate host accessible both by the 
•verification process and from the source location. In 
addition, or alternatively, details enabling the 
predetermined condition to be determined can be provided in 
25 association with the item of value. For example, the 
details could be provided on or in a package containing the 
item of value. This could be done by way of a code such as 
a bar code, it being preferred that the information is 
given in a covert manner. Alternatively, the information 
30 could be contained within a memory chip such as an RFID on 
or in the package. 

The data enabling the predetermined condition to be 
determined could constitute the expected arrival time of 
the destination location, the time at which the item of 
value left the source location, and the like. 

The item of value may be verified directly but 
typically will be secured within a package, the method 
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comprising determining whether the time of arrival of the 
package at the destination location satisfies a 
predetermined condition. 

It should be appreciated that typically the invention 
5 will be used as one part of an overall verification process 
with other verification- steps also being carried out as 
known in the art. These might include, in the case of 
packaged items of value, verifying other security features 
such as security threads, security printing, watermarks and 
10 the like provided on or in the package. 

The source and destination locations can be def ined by 
any pair of locations between which items of value are 
transferred. Examples include retail tills, a retailer 
back office, a cash- in- transit location, and financial 
15 institution such as a bank. 

Some examples of cash transfer processes known in the 
art together with examples of the invention will now be 
described with reference to the accompanying drawings, in 
which: - 

20 Figure 1 illustrates an example, of .a known cash 

management cycle within a typical large retailer; 

Figures 2A and 2B illustrates the current cash cycle 
time line using either the traditional banking cycle or the 
Prime Count cycle, respectively; 
25 Figure 3 illustrates schematically the requirements to 

achieve a secure auditable physical cash flow; 

Figure 4 is a flow diagram illustrating an example of 
the method; and, 

Figure 5 is a schematic block diagram of cash handling 
30 apparatus at a destination location. 

Before considering the invention in detail it is 
worthwhile reviewing one example of a cash management 
cycle. Illustrated in Figure 1 is an example of a cash 
management cycle within the retail environment. 
35 in Figure 1 cash is accepted from a customer at a till 

1A-1C. In the majority of retailers there will be more 
than one till and indeed could be tens of tills. Dependent 
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upon the retailer, the cash may be taken directly to a back 
office 2 to be reconciled or taken via a supervisor 3. The 
supervisor 3 collects the cash and may also issue change, 
and start funds as and when required. Irrespective of the 
5 route, the cash is taken to a secure back office area 2 for 
counting and reconciling internally. 

Once counted and reconciled the cash is taken once a 
week or more frequently to a Cash in Transit (CIT) operator 
4. The transportation of cash is usually via a secure CIT 

10 logistics operator 5. Once the cash is in the CIT it 
usually has to be prepared 6 and put into a format suitable 
for high speed sorting and counting. This process is very 
time consuming and expensive. Once prepared the cash is 
counted and reconciled 7. Dependent upon the CIT 

15 operator's relationship with a commercial bank 8 the cash 
may or may not be then i:aken to the commercial bank via an 
operator 9. Increasingly the cash is held at the CIT 4 and 
redistributed back to -retailers. The bank 8 receives 
details of the cash amount from the CIT 4 and credits the 

20 retailer's account accordingly. This cycle from retailer 
accepting cash to having their account credited may take a 
significant period of time. The period of time is governed 
by the cash cycle within which the retailer is operating. 
There are two main cash cycles utilised by retailers, a 

25 Traditional Banking cycle and the Prime Count cycle which 
are illustrated in Figures 2A and 2B respectively. 

In both cash cycles the trading week is shown as 
running from Sunday to Saturday, which is typical but not 
always the case. Considering first the Prime Count cycle 

30 (Figure 2B) , the cash is collected by a CIT logistics 
operator 4 on a Monday. It is then delivered and through 
Tuesday prepared in a suitable format for counting. On 
Wednesday the cash is then counted and- finally the 
retailer's account is credited on the Thursday. If there is 

35 a very high volume of cash, the preparation and counting 
may take several days each and thus delay the crediting of 
the account. For some retailers who take very large 
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volumes of cash it can be more economically viable to have 
multiple collections during the retail week. 

Within the traditional banking cycle (Figure 2A) again 
the retail week is shown running from Sunday to Saturday. 
5 On Monday the retailer will collect the cash which is then 
counted and reconciled internally on the Tuesday, Late 
Tuesday the cash is collected and taken to the CIT 
operator. The CIT operator prepares and counts the cash on 
Wednesday and into Thursday as appropriate for the volume 

10 of cash. Finally the retailer has their account credited 
on the Thursday or Friday. Again the time required by the 
CIT is very much dependent upon the volume of cash and the 
amount of preparation required. The retailer would like to 
improve this situation in two ways. Firstly the retailer 

15 would like to limit the cost of the CIT logistics, 
preparation and counting operations and secondly the 
retailer would like their account to be credited far 
sooner. 

The cycle shown in Figure 1 has two significant issues 

20 associated with it. Firstly there is a need to increase 
the speed at which cash ownership can be transferred while 
maintaining security of the cash itself. The delay in 
transferring the ownership of cash is directly related to 
the second issue. That is the cycle has numerous points at 

25 which the risk of fraudulent activity is increased. 
Fraudulent activity is most likely to occur where there is 
some form of human interaction with the cash or 
alternatively where the cash is being transported from one 
secure holding point to another. The consequence of these 

30 "high 1 risk points within the cycle is that the recipient 
of the cash* feels it is necessary to recount and reconcile 
the received cash against the value supposedly passed. 

Considering these problems in more detail, the cycle 
illustrated in Figure 1 can be further simplified by 

35 considering the basic components independently of the 
retailer, CIT or commercial bank. This is illustrated in 
Figure 3. In order to achieve a fully integrated retail 
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cash management solution three key elements need to be 
considered* The provision of a secure auditable physical 
cash flow 10, the provision of a secure auditable digital 
cash flow 11 and finally the apparatus and infrastructure 
5 12 required to implement both of the above. The three 
elements are intended to provide the data integrity and 
security to remove the need for multiple cash counts and 
consequently speed up the cash cycle allowing the retailer 
to be credited far sooner. than is currently possible. .The 

10 combination of these three components enables a secure cash 
management . cycle . In one aspect, this invention helps 
enable the secure cash management cycle and may be 
implemented on its own or in combination with one or a 
number of other measures. 

15 The inventors have recognised that while risk can be 

minimised from the cash cycle it cannot be wholly removed. 
Therefore rather than try to eradicate the risk entirely it 
is proposed to provide some means to measure the risk and 
use this measure to set a degree of confidence in the 

20 security of both the physical cash and the data associated 
with it. Within the retail cycle this data is likely to be 
the Electronic Point of Sale (EPOS) data or a subset of 
such along with other pertinent information. 

It is already well known to transport the cash in 

25 secure tamper evident containers. Dependent on the value 
of cash been transported such containers range from 
flexible, envelopes with visual tamper evident devices to 
secure cartridges fitted with sophisticated security and 
degradation systems. Such containers do significantly 

30 reduce the risk of fraudulent activity when transporting 
cash in relatively insecure environments and have proved 
beneficial-. . Further enhancements to such devices are 
described in the applicants co-pending International 
application of even date entitled "Tamper Evident 

35 Container" (Agent' s.Ref: RSJ07664WO) and WO-A- 02/45042 . In 
the former of these two applications a secure tamper 
evident container or envelope is also provided with data 
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relating the contents within. This data may be any or all 

of: 

- ID for the user operating the filling machine 
Filling machine ID 

5 ID of transaction 

- Amount in envelope 

- Contents of envelope, denomination, currency 
type, total value, value denomination 

- Destination of deposit, bank account . number and 
10 type 

* Specific instructions on how the "deposit should 
be handled 

- Method on how the envelope will be deposited 

- How the deposit will take place. 
15 - Time of fill 

WO-A-02/45042 relates specifically to a secure tamper 
evident closure device. It is proposed that by utilizing 
a tamper evident container, which is also coded in such a 
way that its content can be identified without opening the 
20 container, the risk of fraudulent activity can be further 
reduced. 

'. Though the examples above do reduce the risk of 
fraudulent activity they cannot be guaranteed to prevent 
it. Any tamper evident container can be tampered with by 

25 someone with sufficient skill and critically sufficient 
time. The present invention makes use of the fact that 
tampering does indeed take time and this can therefore be 
used as a measure of the risk associated with a container. 
That is if it is known that a container was packed and 

30 shipped at a given time there will be an acceptable period 
of time before it is due to arrive at the recipient. If 
the transfer takes* longer than that predefined period the 
risk that the container has been interfered with 
significantly increases. 

35 A general example of a method according to the 

invention will now be described and this will then be 
further exemplified by some more specific examples. In 
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this example, the steps are set out in Figure 4 and an 
example of apparatus provided at the destination location 
or point of reception of the cash is shown in Figure 5. 
Initially, a package containing cash is received (step 20) 
5 at a reception location such as a back office, cash- in- 
transit handling location, or bank- The package will be 
provided with an indication such as a bar code on its 
external surface (although alternatively or additionally 
the indication could be located within a memory such as an 

10 RFID within the package) and this is read by a bar code 
reader 40. In this example, the time at which the bar code 
reader 4 0 is activated is considered to be the time of 
arrival of the package at the destination location (step 
22) . Of course, the time of arrival could be set in 

15 another way such as the physical time at which the package 
arrives at the location with the code being read later. 
The bar code could define an identifier which a 
microprocessor 42 connected to the reader can use to access 
information from the store which indicates the content of 

2 0 the package and/or its expected time of arrival at the 

reception location. The store is indicated at 44 in Figure 
5 and may be local to the microprocessor 42 or remote, for 
example being connected to the microprocessor 42 via the 
Internet or the like. The memory 44 wili have been updated 
25 with the relevant information at the time the package was 
filled with cash. 

In other versions, the bar code itself may contain 
data defining the expected arrival time which can then be 
used by the microprocessor 42 directly. 

3 0 In any event, the microprocessor 42 determines the 

time or time window at which the package is expected to 
arrive at the reception location (step 24) . . 

The microprocessor 42 then compares the actual time of 
arrival with the expected arrival time or time window (step 
35 26) and if the actual arrival time falls within an accepted 
tolerance of the expected arrival time or within the time 
window then the package is considered to have passed this 
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test and can either be accepted as verified or 
alternatively passed on for further verification steps 
(step 28) . If the package is found to be* unacceptable then 
it will be immediately rejected (step 30) . Rejection 
5 and/or acceptance can be indicated by the microprocessor 
providing a suitable signal to an output device 46 such as 
a display, alarm sound or the like. 

Some examples of specific applications of the method 
will now be described. 

10 Movement of Cash- within a Large Retailer 

We first consider some of the transfer events that 
take place within a retailer such as a large supermarket . 
Cash is accepted at a till 1A-1C, typically by a teller but 
potentially the till may be self service with automated 

15 cash acceptance and dispensing facilities. As the cash is 
accepted at the till EPOS data is generated detailing, 
amongst other things, the value of the transaction. 
Periodically the cash is removed. from the till and taken to 
a back office 2 for reconciliation. This may occur once a 

20 day at the close of business or more often as required. 
Typically the reconciliation process compares the EPOS data 
with the actual till contents and then stores the cash in 
a secure manner. Unfortunately by the time the cash 
reaches the back office 2 it has already been exposed to 

25 risk of .fraudulent activity. The current invention can be 
utilised to provide confidence in • the integrity and 
security of the physical cash and data associated with it 
despite it being transported through a non-secure 
environment . 

30 When moving cash from a source location to a 

destination location (the till to the back office in this 
instance) it is usual to do this as quickly as possible to 
limit the exposure to potentially fraudulent or illegal 
activity. Furthermore it can be estimated approximately 

35 how long that time should be. For example in a large 
supermarket it may take 30 minutes or more from collection 
of the cash from a till until it reaches the back office 
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and is counted into a secure environment. In a smaller 
retailer with fewer tills and less floor space it may only 
take 5 minutes or less. In either scenario an approximate 
transit time is known. If, for whatever reason, the cash 
5 takes in excess of the usual period of time to make the 
journey there is a greater risk that it has been tampered 
with or mishandled in some way. 

The event timing process of the invention can be used 
as means to measure this risk and assess whether there may 

10 be a problem. For example, cash handling apparatus 40*46 
in the back office 2 can be set up to "know" that a till 
1A-1C is due to be cashed up at a certain time. It also 
knows how long it should take the till to cash and how long 
the contents will take to be moved from the till to the 

15 back office. Further to this, the cash handling apparatus 
can know, approximately or accurately, what the value of 
those till contents should be based on previous till totals 
or as a result of the information being loaded into the 
memory 44 from the till or being encoded on or in a package 

20 containing the cash. If for some reason the value of the 
till contents falls short by a significant margin and the 
till took in excess of the estimated time to travel from 
the till to the back office 2 the cash handling apparatus 
could be instructed to alert the user and a supervisor via 

25 the output device 46. The supervisor can then review the 
situation and make a decision as to whether the till 
contents were indeed correct or further action needs to be 
taken. A suitable tolerance can be built into both the 
timing aspect and the value aspect to prevent the cash 

30 handling apparatus from alerting too f requently. The rules 
governing the process could be very simple, as above, or 
more complex. For example the longer the delay between till 
and back office the lower the discrepancy needs to be 
between estimated value and actual value received. 

35 The information relating to the value of contents • 

received may be communicated in a number of ways. In a 
preferred embodiment the tills 1A-1C are networked to the 
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cash handling apparatus 40-46* The actual EPOS data from 
the till could be used to tell the cash handling apparatus 
exactly how much cash to expect. The till would also 
notify the cash handling apparatus that it is being cashed 
5 up and to expect the contents in a certain period of time. 
Even when such accurate data as to expected funds is 
available it is still preferable that some tolerance will 
be built in to allow some variation from the expected 
amount. This will allow for the wrong change being given 
10 and occasional or other minor, accidental errors that will 
always occur. 

Where cash is transported from the till with data 
associated with it, the cash may be held in a secure 
container or envelope to which is associated a suitable 
15 data storage device providing detail on the value, 
denomination and potentially other EPOS data. Such a 
situation is described in more detail' in the previously 
mentioned co-pending applications. It may be a printed bar. 
code, data in a memory such as a RFID etc. . . 

20 • In this case, the retailer back office 2 receives cash 

(step 20, Figure 4) and determines its time of arrival 
(step 22) . 

Here as the value and denomination is stored Becurely 
it is theoretically possible to avoid the need to recount 
the cash. However the user has to trust that both the 
physical cash and data associated with it have retained, 
their integrity. Obviously, as before, the longer the 
secure container is not in a secure environment, such as 
being carried across a shop floor, the longer it is exposed 
to risk. If the container is. transported from th6 till ta 
the back office within the allotted time the cash handling 
apparatus will trust the data and will not request the cash 
be counted again. The container can then be stored 
securely in a safe area. Upon acceptance of the valid data 
the cash handling apparatus will update a data file to 
indicate that the cash has been accounted for and stored 
securely. If however the cash is not presented within the 
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prescribed time limit the cash handling apparatus will 
request the cash be counted again. If the value is correct 
the data file will be "updated and the cash taken for secure 
storage* If the value is wrong a supervisor will be 
5 alerted and further action taken as required. 

A further benefit is that by using either the timing 
device or a network process the cash handling device is 
also in a much better position to pre-empt and predict 
forthcoming activity and take steps to ensure no delay is 

10 caused to the users. By minimising delays and having some 
knowledge of what to expect the process minimises the risk. 

So far we have suggested using the timing process in 
isolation to determine whether to trust the data associated 
with it. In reality it is likely to be only one of a 

15 number of factors considered when deciding whether or not 
to trust the integrity of the container. Consideration may 
also be given to other factors such as the physical 
integrity of the container, the environment through which 
the container is being transported. Further detail and an 

20 example of a method and apparatus for inspecting the 
physical integrity of a container is given in our 
International application of even date entitled "Tamper 
Evident Container" (Agent's Ref: RSJ07664WO) . 

The example above focuses on the relatively closed 

25 system wholly within a retailer. It should be appreciated 
that the invention could find wider application within the 
retail cash cycle. Indeed the invention could find 
application at any point in the cash cycle where physical 
cash is moved between two points e.g. from the retailer 2 

30 to the CIT 4 or from the CIT 4 to the commercial bank 8. 
Movement of non-cash items 

As indicated previously the invention could also be 
equally well applied in non-retail applications. For 
example one serious issue faced by lottery scratch cards is 
35 tampering. Lottery scratch cards are used in prize games 
and may have a potential value of thousands of pounds. 
Despite that, they are relatively insecure documents due to 
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the pressure to minimise costs of production. There is a 
trend to increase the security of such documents but they 
still remain a relatively simple document to tamper with. 
It is known for unscrupulous individuals to inspect scratch 
5 cards by various means to locate cards having winning 
values associated with them. They then remove these cards 
leaving only those cards with no or very low winning 
values. Such inspection may be relatively crude, for 
example removing the scratch off ink and then reprinting it 
10 onto cards with no value. Alternatively, more advanced 
non-destructive techniques may be used. Common to* Whatever 
approach that is used is that the process of inspection 
takes time. 

Typically, scratch cards are manufactured and stored 

15 in a controlled environment and when they arrive in a store 
they are also stored in a secure manner. However, as in 
the retail cash cycle example, there is a period where they 
have to be transported between the two secure points and 
therefore exposed to a risk. To overcome this, during 

20 transportation the scratch cards are placed in a tamper 
evident container. In addition, the tamper evident 
container is provided with details of its contents, the 
time it was filled and the time it is due to arrive at the 
retailer. Such information should be provided in a form 

25 that can be read by the receiving party. In this instance 
as the receiving party is likely to be a retailer or store 
one possible format is a bar code. The majority of stores 
nowadays have bar code reading equipment and would be able 
to read the bar code. When the store receives the 

30 container, prior to accepting the scratch* cards they will 
read the bar code to view the information regarding 
contents, time of dispatch and expected time of arrival. 
If all is correct the store accepts the scratch cards. If 
some thing is incorrect the store may refuse the scratch 

35 cards or may have a phone number to ring in order to make 
an enquiry as to the discrepancy. 
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CLAIMS 

1. A method of verifying the integrity of an item of 
value received at a destination location following transfer 
5 from a source location, the method comprising carrying out 
one or more verification steps, at least one of which 
comprises determining whether the time of arrival of the 
item of value at the destination location satisfies a 
predetermined condition. 
10 2. A method according to claim 1, wherein the 
predetermined condition- is defined by an absolute time 
period within which the item of value is expected. 

3. A method according to claim 1, wherein the 
predetermined condition comprises the expected length of 

15 time between the item of value leaving the source location 
and arriving at the destination location. 

4. A method according to any of the preceding claims , 
wherein details of the predetermined condition are stored 
in a memory at the destination location. 

20 5. A method according to any of claims 1 to 3, wherein 
details of the predetermined condition are provided in 
association with the item of value. 

6. A method according to any of the preceding claims, 
wherein the item of value is secured within a package, the 

25 method comprising determining whether the time of arrival 
of the package at the destination location satisfies a 
predetermined condition. 

7. A method according to claim 6, wherein the details of 
the predetermined condition are provided on or in the 

30 package. 

8. A method according to claim 6 or claim 7, wherein the 
package is tamper evident. 

9. A method according to any of the preceding claims,, 
wherein details relating to the predetermined condition are 

35 communicated from the source location to the destination 
location. 
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10. A method according to claim 9, wherein the details 
comprise one or more of the time of departure from the 
source location, the expected time of arrival at the 
destination location, and the length of time between 

5 leaving the source location and arriving at the destination 
location. 

11. A method according to any of the preceding claims, 
wherein the item of value comprises cash, for example coins 
and/or banknotes. 

10 12. A method according to any of the preceding claims, 
wherein the source location comprises one of a retail till, 
retailer back of f ice, cash- in- transit centre, and financial 
institution such as a bank. 

13. A method according to any of the preceding claims, 
15 wherein the destination location comprises one of a retail 

till, retailer back office, cash-in-tranpit centre, and 
financial institution such as a bank. 

14 . . Apparatus for verifying the integrity of an item of 
value received at a destination location following transfer 

20 from a source location, the apparatus comprising a 
verification system for carrying out one or more 
verification steps, at least one of which comprises 
determining whether the time of arrival of the item of 
value at the destination location satisfies a predetermined 

25 condition. 

15. Apparatus according . to claim 14 for carrying out a 
method according to any of claims 1 to 13 . 

16. An item of value transfer system comprising apparatus 
according to claim 14 or claim 15 located at a destination 

30 location; and a source location from which items of value 
are transferred, to the destination location. 
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